diff options
| author |   Jackie Huang <jackie.huang@windriver.com> | 2014-08-18 03:05:02 -0400 |
|---|---|---|
| committer |   Martin Jansa <Martin.Jansa@gmail.com> | 2014-08-21 21:35:07 +0200 |
| commit | 778ddba7010febf0b5c8029f09e83a3288eaa18b (patch) | |
| tree | 81ffc747848c4fe700ac484d7f3e1294a189414d /meta-networking/recipes-support/strongswan/files/strongswan-5.0.0-5.1.2_reject_child_sa.patch | |
| parent | c73e26932dcbb8bbe1895ba969e0c41cd9bbf850 (diff) | |
| download | meta-openembedded-contrib-778ddba7010febf0b5c8029f09e83a3288eaa18b.tar.gz | |
strongswan: uprev to version 5.2.0
* removed two patches which were already integrated in 5.2.0:
strongswan-4.3.3-5.1.1_asn1_unwrap.patch
strongswan-5.0.0-5.1.2_reject_child_sa.patch
Signed-off-by: Jackie Huang <jackie.huang@windriver.com>
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
Diffstat (limited to 'meta-networking/recipes-support/strongswan/files/strongswan-5.0.0-5.1.2_reject_child_sa.patch')
| -rw-r--r-- | meta-networking/recipes-support/strongswan/files/strongswan-5.0.0-5.1.2_reject_child_sa.patch | 36 |
1 files changed, 0 insertions, 36 deletions
diff --git a/meta-networking/recipes-support/strongswan/files/strongswan-5.0.0-5.1.2_reject_child_sa.patch b/meta-networking/recipes-support/strongswan/files/strongswan-5.0.0-5.1.2_reject_child_sa.patch deleted file mode 100644 index ad3459e995..0000000000 --- a/meta-networking/recipes-support/strongswan/files/strongswan-5.0.0-5.1.2_reject_child_sa.patch +++ /dev/null @@ -1,36 +0,0 @@ -From b980ba7757dcfedd756aa055b3271ea58cf85aa6 Mon Sep 17 00:00:00 2001 -From: Martin Willi <martin@revosec.ch> -Date: Thu, 20 Feb 2014 16:08:43 +0100 -Subject: [PATCH] ikev2: Reject CREATE_CHILD_SA exchange on unestablished - IKE_SAs - -Prevents a responder peer to trick us into established state by starting -IKE_SA rekeying before the IKE_SA has been authenticated during IKE_AUTH. - -Fixes CVE-2014-2338 for 5.x versions of strongSwan. ---- - src/libcharon/sa/ikev2/task_manager_v2.c | 9 +++++++++ - 1 file changed, 9 insertions(+) - -diff --git a/src/libcharon/sa/ikev2/task_manager_v2.c b/src/libcharon/sa/ikev2/task_manager_v2.c -index ac3be90..a5252ab 100644 ---- a/src/libcharon/sa/ikev2/task_manager_v2.c -+++ b/src/libcharon/sa/ikev2/task_manager_v2.c -@@ -780,6 +780,15 @@ static status_t process_request(private_ - case CREATE_CHILD_SA: - { /* FIXME: we should prevent this on mediation connections */ - bool notify_found = FALSE, ts_found = FALSE; -+ -+ if (this->ike_sa->get_state(this->ike_sa) == IKE_CREATED || -+ this->ike_sa->get_state(this->ike_sa) == IKE_CONNECTING) -+ { -+ DBG1(DBG_IKE, "received CREATE_CHILD_SA request for " -+ "unestablished IKE_SA, rejected"); -+ return FAILED; -+ } -+ - enumerator = message->create_payload_enumerator(message); - while (enumerator->enumerate(enumerator, &payload)) - { --- -1.8.1.2 |